Loading HuntDB...

CVE-2024-3393

UNKNOWN
Published 2024-12-27T09:44:24.538Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2024-3393. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Understanding This Vulnerability

This Common Vulnerabilities and Exposures (CVE) entry provides detailed information about a security vulnerability that has been publicly disclosed. CVEs are standardized identifiers assigned by MITRE Corporation to track and catalog security vulnerabilities across software and hardware products.

The severity rating (UNKNOWN) indicates the potential impact of this vulnerability based on the CVSS (Common Vulnerability Scoring System) framework. Higher severity ratings typically indicate vulnerabilities that could lead to more significant security breaches if exploited. Security teams should prioritize remediation efforts based on severity, exploit availability, and the EPSS (Exploit Prediction Scoring System) score, which predicts the likelihood of exploitation in the wild.

If this vulnerability affects products or systems in your infrastructure, we recommend reviewing the affected products section, checking for available patches or updates from vendors, and implementing recommended workarounds or solutions until a permanent fix is available. Organizations should also monitor security advisories and threat intelligence feeds for updates about active exploitation of this vulnerability.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

References

Workarounds

If your firewall running the vulnerable PAN-OS versions stops responding or reboots unexpectedly and you cannot immediately apply a fix, apply a workaround below based on your deployment.

Unmanaged NGFWs, NGFW managed by Panorama, or Prisma Access managed by Panorama
* For each Anti-spyware profile, navigate to Objects → Security Profiles → Anti-spyware → (select a profile) → DNS Policies → DNS Security.
* Change the Log Severity to "none" for all configured DNS Security categories.

* Commit the changes.

Remember to revert the Log Severity settings once the fixes are applied.

NGFW managed by Strata Cloud Manager (SCM)

You can choose one of the following mitigation options:

* Option 1: Disable DNS Security logging directly on each NGFW by following the PAN-OS steps above.
* Option 2: Disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index .

Prisma Access managed by Strata Cloud Manager (SCM)

Until we perform an upgrade of your Prisma Access tenant, you can disable DNS Security logging across all NGFWs in your tenant by opening a support case https://support.paloaltonetworks.com/Support/Index . If you would like to expedite the upgrade, please make a note of that in the support case.

Solutions

This issue is fixed in PAN-OS 10.1.14-h8, PAN-OS 10.2.10-h12, PAN-OS 11.1.5, PAN-OS 11.2.3, and all later PAN-OS versions.

Note: PAN-OS 11.0 reached the end of life (EOL) on November 17, 2024, so we do not intend to provide a fix for this release.

Prisma Access customers using DNS Security with affected PAN-OS versions should apply one of the workarounds provided below. We will perform upgrades in two phases for impacted customers on the weekends of January 3rd and January 10th. You can request an expedited Prisma Access upgrade to the latest PAN-OS version by opening a support case https://support.paloaltonetworks.com/Support/Index .

In addition, to provide the most seamless upgrade path for our customers, we are making fixes available for other TAC-preferred and commonly deployed maintenance releases.

​​Additional PAN-OS 11.1 fixes:

* 11.1.2-h16
* 11.1.3-h13
* 11.1.4-h7
* 11.1.5

Additional PAN-OS 10.2 fixes:

* 10.2.8-h19
* 10.2.9-h19
* 10.2.10-h12
* 10.2.11-h10
* 10.2.12-h4
* 10.2.13-h2
* 10.2.14

Additional PAN-OS 10.1 fixes:

* 10.1.14-h8
* 10.1.15

Additional PAN-OS fixes only applicable to Prisma Access:

* 10.2.9-h19
* 10.2.10-h12

Credits & Acknowledgments

reporter

Palo Alto Networks thanks the CERT-EE team for their extra effort in providing invaluable forensic and analytic assistance.

Timeline

Initial publication

Known Exploited Vulnerability

This vulnerability is actively being exploited in the wild

View KEV Details

Remediation Status

Overdue

Due Date

January 20, 2025

Added to KEV

December 30, 2024

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Product

Vendor/Project: Palo Alto Networks
Product: PAN-OS

Ransomware Risk

Known Ransomware Use
KEV Catalog Version: 2025.01.24 Released: January 24, 2025

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-gm94-vr86-wgqv

Advisory Details

A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

CVSS Scoring

CVSS Score

7.5

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Advisory provided by GitHub Security Advisory Database. Published: December 27, 2024, Modified: October 22, 2025

References

Published: 2024-12-27T09:44:24.538Z
Last Modified: 2025-07-28T19:42:31.418Z
Copied to clipboard!